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This module should be read in conjunction with the Introduction and with the 
Glossary, which contains an explanation of abbreviations and other terms used in 
this Manual. If reading on-line, click on blue underlined headings to activate 
hyperlinks to the relevant module. 


Purpose 


To specify the minimum standards that Als should observe in relation to 
the sharing and use of consumer credit data through a credit reference 
agency 


Classification 


A statutory guideline issued by the MA under the Banking Ordinance, 
§16(10) 


Previous guidelines superseded 


IC-6 “The Sharing and Use of Consumer Credit Data through a Credit 
Reference Agency” (V.4 dated 02.09.11) 


Application 


To Als which are involved in the provision of consumer credit 


Structure 
1. Introduction 
2 Definition 
3. Comprehensive participation 
4 Handling of positive mortgage data 


4.1 General 
4.2 Pre-existing mortgage data 
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1.1 


IC-6 The Sharing and Use of Consumer Speed 
Credit Data through a Credit 
Reference Agency 

4.3 New mortgage loan data 

5. Safeguards on information security 
5.1 General 
5.2 Policies and procedures 
5:3 Access control 
5.4 Confidentiality and retention of CRA credit data 
5.5 Data accuracy 
5.6 Audit trail 
5.7 Compliance audit 
5.8 Staff training 

6. Notification of access for review and right to opt-out 

7. Access to Mortgage Count during the transitional period 

8. Engagement of CRA 

9. Hong Kong Approach to Consumer Debt Difficulties 

1. Introduction 


When positive consumer credit data sharing (excluding positive 
mortgage loan data) was introduced in Hong Kong in 2003, the 
scope of data sharing primarily covered the sharing of positive and 
negative credit data relating to credit cards and unsecured personal 
loans, as well as the negative credit data relating to mortgage 
loans. Following the public consultation on the sharing of mortgage 
data for credit assessment as proposed by the financial industry in 
January 2011, the Privacy Commissioner for Personal Data (the 
“PC”) was convinced that positive mortgage data sharing (“PMDS”) 
would lead to responsible borrowing and lending. The Code of 
Practice on Consumer Credit Data (“the Code”) was revised on 1 
April 2011 as a consequence to allow for the implementation of 
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1.2 


1.3 


1.4 


PMDS. 


The Code provides practical guidance to credit providers, including 
Als and their subsidiaries within the meaning of 82 of the Banking 
Ordinance, and credit reference agencies (“CRAs”) on the handling 
of consumer credit data. It deals with issues relating to the 
collection, accuracy, use, security, access and correction of 
consumer credit data. A breach of the requirements under the 
Code would be accepted as evidence of breach of the relevant data 
protection principles or provisions under the Personal Data 
(Privacy) Ordinance (“PDPO”) unless there is evidence that the 
requirement of the Ordinance was actually complied with in a 
different way, notwithstanding the non-observance of the Code. 
The PC may issue an enforcement notice to a data user following 
investigation of an alleged contravention of the relevant data 
protection principles and provisions of the PDPO. Contravention of 
the enforcement notice by a data user after the enforcement notice 
is served on him would constitute an offence. In case of any 
conflict between this module and the Code, the Code shall prevail. 


The minimum authorization criterion under paragraph 10 of the 
Seventh Schedule to the Banking Ordinance provides that the MA 
must be satisfied that an Al has, among others, adequate systems 
of control. The MA considers that this would include adequate 
systems of control to enable the Al to manage its credit risk 
effectively, and to properly protect and use consumer credit data. 
In this regard, the MA will take into account the extent to which Als 
make full use of all relevant information (including that obtained 
from CRAs) in managing their credit exposure and whether Als 
have adequate controls to ensure that their consumer credit data 
are properly safeguarded. 


Failure to adhere to the standards and requirements set out in this 
module may call into question whether the Al continues to satisfy 
the relevant authorization criterion under the Banking Ordinance. 





HONG KONG MONETARY AUTHORITY 
A HE ae th E BE a 





Supervisory Policy Manual 




















IC-6 The Sharing and Use of Consumer V.5 — 14.02.14 
Credit Data through a Credit 
Reference Agency 
2. Definition 
2.1 The terms used in this module have the following meaning: 


“Consumer credit data” means any personal data 
concerning an individual collected by an Al in the course of 
or in connection with the provision of consumer credit, or 
any personal data collected by or generated in the database 
of a CRA (including the mortgage count) in the course of or 
in connection with the providing of consumer credit 
reference service. 


“Consumer credit” means any loan, overdraft facility or other 
kind of credit, including leasing and hire-purchase, provided 
by an Al to and for the use of an individual as borrower, or 
to and for the use of another person for whom an individual 
acts as mortgagor or guarantor. 


“Credit reference agency” (“CRA”) means any data user 
who carries on a business of providing a consumer credit 
reference service, whether or not that business is the sole 
or principal activity of that CRA. 


“Debt Relief Plan” means an agreement to be concluded 
between a Debtor and all Creditors, having an exposure to 
the Debtor, for partial relief and/or rescheduling of debts 
owed to those Creditors pursuant to the terms of the 
Agreement for Debt Relief Plans endorsed by the Hong 
Kong Association of Banks, the DTC Association, the 
Finance Houses Association of Hong Kong Limited and the 
Hong Kong S.A.R. Licensed Money Lenders Association. 


“Effective date” means 1 April 2011. 
“Loan restructuring arrangement” means any scheme of 


arrangement in relation to debts owed by an individual 
consequent upon a default in the repayment of those debts. 
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“Material default” means a default in payment for a period in 
excess of 60 days. 


“Mortgage account general data” has the same meaning as 
in clause 2.4.4A of the Code of Practice on Consumer 
Credit Data. 


“Mortgage loan” means a loan secured or to be secured by 
residential, retail, commercial or industrial properties, unless 
otherwise specified, and reference to “mortgage” shall be 
construed accordingly. 


“Mortgage Count” means the number of mortgage loans 
under which an individual is a borrower, mortgagor and/or 
guarantor. 


“Prescribed consent” means the express consent of an 
individual given voluntarily but does not include any consent 
which has been withdrawn by notice in writing served on the 
person to whom the consent has been given (but without 
prejudice to so much of that act that has been done 
pursuant to the consent at any time before the notice is so 
served). 


For the purpose of paragraphs 5.3.1, 6.1, 6.5 and 7.1 and 
other related paragraphs, “review” means consideration by 
the Al of any of the following matters (and those matters 
only) in relation to existing credit facilities provided to the 
individual, namely: (i) an increase in the credit amount; (ii) 
the curtailing of credit (including the cancellation of credit or 
a decrease in the credit amount); or (iii) the putting in place 
or the implementation of a scheme of arrangement with the 
individual. 


“Scheme of arrangement” means any restructuring, 
rescheduling or other modification of terms of whatsoever 
nature in relation to debts owed by an individual, whether as 
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borrower, aS mortgagor or as guarantor, towards a single 
creditor or more than one creditors. 


° “Transitional period” means the period of 24 months 
beginning on the effective date and ending on the day 
before the second anniversary of the effective date. 


3. Comprehensive participation 


3.1 The HKMA believes that a fully-fledged consumer credit database, 
including both positive and negative data, will be beneficial to Als 
(in enabling them to be better informed and make more accurate 
assessment of customers’ creditworthiness) and consumers (in 
enforcing borrower discipline, reducing cross subsidisation among 
consumers with different credit profiles and improving access to 
bank funding). However, to realise such benefits, the database 
must be adequately comprehensive and Als need to make full use 
of the database in their credit decisions. 


3.2 In order to enable an adequately comprehensive database to be 
built up, which would help Als better manage their consumer credit 
exposure, the HKMA expects all Als that are involved in the 
provision of consumer credit to participate as fully as possible in the 
sharing and use of consumer credit data through a CRA within the 
framework laid down by the Code. Following the amendments to 
the Code on 1 April 2011, the HKMA expects all Als to share and 
use positive mortgage data through the CRA within the framework 
laid down in the revised Code. At a minimum, Als should share 
consumer credit data to the extent recommended by the Hong 
Kong Association of Banks and the DTC Association. 


3.3 The HKMA also considers that using consumer credit data from a 
CRA for assessing credit applications (including mortgage loan 
applications) and conducting credit reviews is an essential part of 
an Al’s credit management system unless there are satisfactory 
alternative arrangements for the comprehensive sharing of 
consumer credit data. 


3.4 The HKMA would take into account the extent to which an Al 
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3.5 


3.6 


participates in the contribution of consumer credit data to and 
makes full use of the same from a CRA in assessing the 
effectiveness of the Al’s credit management system. 


Where an Al does not, in the opinion of the HKMA, make 
appropriate use of the relevant facilities of a CRA, one option would 
be for the HKMA to require the Al concerned to mitigate the risk by 
restricting the amount of consumer credit business that it 
undertakes. 


The senior management of Als should ensure that sufficient priority 
and resources are devoted to enabling the computer systems of 
their institution to interface with those of the CRA in a timely and 
effective manner, in terms of contributing and making enquiry of 
consumer credit data. 


Handling of positive mortgage data 


4.1 


General 


4.1.1 For the purpose of setting up a comprehensive mortgage 
loan database by the CRA and to comply with the PDPO’s 
requirement, Als are required to seek the prescribed 
consent of their existing mortgage customers and mortgage 
loan applicants before uploading their pre-existing mortgage 
data to the CRA. Pre-existing mortgage data refers to the 
mortgage account general data of any account relating to a 
mortgage loan which already existed prior to the effective 
date and continues to exist after that date. 


4.1.2 Where prescribed consent is obtained, an Al should adopt 
prudent procedures to check its validity through verifying the 
signature of a customer on the consent seeking form or 
other appropriate means. 


4.1.3 To ensure a level playing field and the comprehensiveness 
of the CRA database, the HKMA will, as and when 
appropriate, monitor through regular surveys and enquiries 
to ensure that Als are seeking the prescribed consent of all 
relevant customers and do not do so only on a selective 
basis. 
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4.2 


4.3 


Pre-existing mortgage data 


4.2.1 With a view to building up a comprehensive mortgage loan 


database, Als are required to perform a one-off exercise to 
issue consent seeking forms from 1 April 2011 onwards to 
seek the prescribed consent of existing mortgage customers 
(i.e. borrowers, mortgagors or guarantors) for the uploading 
of their pre-existing mortgage data to the CRA. 


New mortgage loan data 


4.3.1 


4.3.2 


4.3.3 


Following the amendments to the Code on 1 April 2011, 
subject to Als’ compliance of the notification requirement 
under clause 2.1B of the Code, Als have the right to upload 
to the CRA the mortgage account general data of new 
mortgage loans whose applications are received on or after 
the effective date. To enable the uploading of such 
mortgage data, Als should ensure that before collecting 
customers’ personal data for mortgage loan applications, 
the relevant Personal Information Collection Statement is 
provided to customers in order to comply with the 
notification requirements under the Code pertaining to the 
provision of consumer credit data relating to mortgage 
loans. 


In order to make full use of the PMDS scheme, for all 
relevant mortgage loan applications received on or after the 
effective date, the HKMA expects that Als would, as part of 
the mortgage loan application process, seek to obtain from 
mortgage loan applicants prescribed consent for the 
uploading of their pre-existing positive mortgage data to the 
CRA in case they have not already given such consent 
previously. 


Als should explain to the mortgage applicant that the 
prescribed consent applies to the pre-existing positive 
mortgage data and such consent will be addressed to all 
credit providers who are members of the CRA (“Members”) 
and to the CRA. After the prescribed consent is received, it 
will be passed to the CRA which will then check with all its 
Members to verify if the customer has any mortgage loan 
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4.3.4 


4.3.5 


4.3.6 


4.3.7 


with any of them. The CRA will upload any mortgage 
account general data of the customer it receives to its 
database, compile the mortgage count of that customer, and 
then report the mortgage count back to the mortgage loan 
processing Al. 


Where prescribed consent for the sharing of pre-existing 
positive mortgage data and written consent for accessing 
the mortgage count held by the CRA are obtained from a 
mortgage loan applicant, the mortgage loan processing Al 
should make use of the mortgage count information 
obtained from the CRA in verifying the applicant’s 
declaration in respect of his existing mortgage loan(s). 


Als should check the mortgage count declared by the 
mortgage loan applicant against the mortgage count 
obtained from the CRA. Follow-up enquiries should be 
conducted by the Al during the loan approval process in 
case of any discrepancy especially where the declared 
mortgage count is smaller than the mortgage count obtained 
from the CRA. There should be clear and detailed policies 
and procedures established by Als on the mortgage count 
verification process and the course of actions that Als 
should take where the discrepancy cannot be reconciled. 


Where prescribed consent is not obtained, the Al may still 
continue to process the mortgage loan application by 
obtaining additional relevant information from the applicant 
to assess the applicant’s repayment ability. The Al will then 
decide whether it has sufficient information to conduct a 
credit assessment of the customer and whether additional 
measures are required to mitigate the potential credit risk 
involved. In this regard, Als should comply with the 
requirements stipulated in the relevant guidelines or 
circulars pertaining to PMDS and mortgage loan business 
as issued by the HKMA from time to time. 


An individual may withdraw his prescribed consent in 
relation to the sharing of pre-existing positive mortgage data 
by giving a notice in writing. Once received, the Al should 
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inform the CRA as soon as practicable for follow-up. Als 
should establish appropriate policies and procedures on the 
handling of customers’ withdrawal notices and make 
reference to the relevant requirements of the PDPO where 
appropriate. 

5. Safeguards on information security 


5.1 


5.2 


General 


5.1.1 


For any credit information sharing arrangement to be 
effective and credible, the data must be properly 
safeguarded. Otherwise, Als would be subject to 
substantial legal and reputation risks. Als should therefore 
adopt all reasonable procedures to ensure that consumer 
credit data disclosed to or obtained from a CRA are properly 
safeguarded, with regard to the confidentiality, accuracy, 
relevance and proper utilisation of the information. 


Policies and procedures 


5.2.1 


5.2.2 


Als should have clear and comprehensive policies and 
procedures for the sharing and use of consumer credit data 
through a CRA to ensure compliance with the requirements 
of the Code. The policies and procedures should be 
designed to: 


° ensure the security, confidentiality and integrity of 
consumer credit data; and 


e guard against unauthorized access to or use of such 
information that could result in a breach of the Code 
and the data protection principles and relevant 
provisions under the PDPO. 


These policies and procedures should be approved by the 
Board or a designated authority and be properly 
documented. They should be reviewed and updated 
regularly to ensure that they remain appropriate in the light 
of changes in relevant legislation and regulations. Any 


10 
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5.2.3 


5.2.4 


material amendments to the policies and procedures should 
be submitted to the Board or a designated authority for 
formal ratification and adoption. 


The policies and procedures should specify how consumer 
credit data should be handled in cases where the credit 
application is submitted by an intermediary, who is 
commissioned by the credit applicant to handle his 
application, rather than by the credit applicant himself. In 
processing such a credit application, the Al concerned 
should ensure that the intermediary has obtained the 
authorization of the credit applicant to apply for credit on his 
behalf and to authorize the Al concerned to access the 
applicant’s credit data held by a CRA. Where the 
intermediary does not have such authorization, the Al 
should contact the credit applicant directly to confirm his 
intention to apply for credit from the Al and advise the credit 
applicant that it may access his credit data held by a CRA 
for the purpose of assessing his application. In these latter 
cases, the Al should also address all future 
correspondence, including any statements or notifications 
required under the Code, to the credit applicant rather than 
the intermediary. 


Als should ensure adequate management oversight, at an 
appropriate senior level, on the development, 
implementation, and maintenance of these policies and 
procedures. There should also be an effective mechanism 
in place to monitor compliance with them. Any non- 
compliance should be followed up, investigated, rectified 
and reported to management. 


5.3 Access control 


5.3.1 


Als should have written policies specifying who may 
authorize access to the CRA database, and the criteria that 
need to be met for making such access for review purposes. 
The policies should define clearly the circumstances under 
which an Al may initiate reviews. 


11 
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5.3.2 


5.3.3 


5.3.4 


5.3.5 


5.3.6 


5.3.7 


Only designated persons authorized by management should 
be able to access the CRA database. There should be 
clearly defined procedures for the authorization of such 
designated persons. Such authorization, and any 
subsequent changes, must be documented. 


Als should maintain stringent control over the use of and 
changes made to the passwords for access to the CRA 
database. The passwords should only be made available to 
the designated persons who are authorized to access the 
CRA database. Als should avoid using shared passwords 
(i.e. two or more persons sharing the same password). 
Under no circumstances should passwords be disclosed to 
unauthorized persons, e.g. IT maintenance or service 
contractors. 


Where access to the CRA database is made through 
designated terminals, access to the CRA database through 
such terminals should be restricted only to designated 
persons, such as by way of password protection. 


Als should change the passwords for accessing the CRA 
database regularly, preferably at least quarterly. 


Als should maintain an access log on all instances of 
access to the CRA database. The access log should 
contain sufficient detail as evidence of compliance with the 
Code. It should, as a minimum, contain information about 
the purpose of the access, the date on which the access 
was made and the staff who made the access. 


The Al’s internal access log and billing records from the 
CRA should be regularly reviewed, at least on a monthly 
basis, for unusual access activities, such as an unusually 
high volume of access activities that is inconsistent with the 
Al’s business. Such unusual access activities might 
suggest that the designated persons have abused the 
system. Alternatively, any unexplained shortfall in the 
number of instances of access in the Al’s internal access 
records when compared with the CRA’s billing records 


12 
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5.4 


5.3.8 


might suggest unauthorized access or breaches of the Al’s 
access control. 


Als should undertake prompt investigation of any unusual 
access activities and take prompt remedial actions to follow 
up any irregularities. Such irregularities, and the reasons 
for them, should be brought to management’s attention. As 
required by the Code, Als should report any suspected 
breaches of the PDPO or the Code to the PC. 


Confidentiality and retention of CRA credit data 


9.4.1 


5.4.2 


5.4.3 


Als should establish a policy on the safeguarding and 
retention of customer data obtained from the CRA. 
Specifically, the policy should provide that access to the 
CRA credit report should be on a need to know basis. 
There should also be restrictions on how such reports may 
be duplicated, copied or circulated. 


Data Protection Principle 2 of the PDPO requires that 
personal data shall not be kept longer than is necessary for 
the fulfilment of the purpose for which the data are or are to 
be used. Als may need to retain credit reports from a CRA 
as documentary support for the relevant credit decisions for 
which the credit reports were obtained, and as file records in 
the event of subsequent queries or disputes raised by 
customers. With the CRA database being updated 
regularly, there would be a breach of the Principles if ‘out-of- 
date’ information were to be retained and used for making 
subsequent credit decisions. Als should ensure that they do 
not use out of date credit reports for making credit 
decisions. 


Where a CRA credit report is obtained for the purpose of 
assessing a credit application and the Al subsequently 
refused the application, or when a customer ceases to have 
any borrowing relationship with the Al, the Al should destroy 
the relevant credit reports within a reasonable period unless 
such reports are to be used for other permitted purposes. 


13 
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5.5 


Data accuracy 


9.5.1 


5:5:2 


5.5.3 


5.5.4 


5.5.5 


Als should take reasonably practicable steps to check the 
accuracy of their customers’ credit data before passing 
them to the CRA. Clear procedures should be laid down on 
how changes to customers’ credit data are to be 
implemented, verified and transmitted to the CRA. 


As for data updating, the Code requires Als to update any 
account data or mortgage account general data previously 
provided to a CRA promptly or, in any event, by the end of 
each reporting period not exceeding 31 days, until the 
account is terminated or written-off, whereupon the Al shall 
promptly update the account data to indicate such 
termination or write-off. 


In addition, Als should, as soon as reasonably practicable, 
update an individual’s credit data upon the occurring of 
repayment in full or in part of any amount in default; a 
scheme of arrangement being entered into with the 
individual; the final settlement of the amount payable 
pursuant to such a scheme of arrangement; or the write off 
of any amount whether or not the amount has been in 
default or the subsequent repayment in full or in part of the 
written off amount. 


Als should follow the requirements set out in clauses 2.7A 
and 2.7B of the Code, with effect from 1 July 2011, in 
reporting account data or mortgage account general data 
held in the database of the CRA. Essentially, in the event 
that an individual makes a request to an Al for updating 
under the circumstances as mentioned in section 5.5.3 
above, the Al should update the account data or mortgage 
account general data of the individual held in the database 
of the CRA promptly and in any event not later than 14 days 
from the date of receiving the request. 


Where an Al has been provided by a CRA with a credit 
report on an individual and has considered such credit 
report in connection with an application for consumer credit 
by that individual, the Al should, in its notification to the 
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5.6 


5.7 


5.5.6 


individual of its decision on the application, give notice of 
the fact that a credit report has been so considered. The Al 
should also advise the individual on how to contact the CRA 
which provided the credit report, for the purpose of obtaining 
a copy of the credit report for free under clause 3.18 of the 
Code (in which case, the Al has rejected the individual’s 
credit application) and to make a data correction request 
under the PDPO, where appropriate. If a correction request 
made by the individual is subsequently complied with by the 
CRA, the Al concerned should at the request of the 
individual reconsider the credit application on the basis of a 
new credit report obtained from the CRA. 


Where an Al provides consumer credit data which is being 
disputed by the consumer concerned to a CRA, it should 
clearly indicate to the CRA the existence of such a dispute 
and update the data as soon as reasonably practicable 
upon the settlement of the dispute. 


Audit trail 


5.6.1 


The access log records, any investigation reports and follow 
up actions on irregularities or exceptions should be properly 
documented and kept for not less than 2 years. They 
should be maintained in such a manner that would facilitate 
compliance reviews and audits. 


Compliance audit 


5.7.1 


5.7.2 


Als should conduct a compliance audit at least annually to 
verify whether their data management practices are 
adequate to ensure compliance with the requirements of the 
Code, this module and internal policies and procedures 
regarding the sharing of consumer credit data. 


The audit report should be submitted to the Al’s Board or a 
designated authority for review. This report should assess 
the overall effectiveness of the data management practices 
in ensuring compliance with the Code and this module. The 
reports should cover issues like security breaches or 
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5.8 


violations, management's responses and recommendations 
for improvement. 


Staff training 


5.8.1 Als should provide appropriate guidance and training to staff 
who are involved in the sharing and use of consumer credit 
data through CRAs. In particular, staff involved in the 
handling of consumer credit data should familiarise 
themselves with the provisions of the Code, this module and 
controls to safeguard the confidentiality of such data. 


Notification of access for review and right to opt-out 


6.1 


6.2 


6.3 


6.4 


The Code requires credit providers to take practicable and 
reasonable steps to give prior notification to customers of their 
intention to access the CRA’s database for the purpose of a review 
(whether within or outside the transitional period) unless the review 
is initiated by the customer, or relates to an obligation of an existing 
loan restructuring arrangement concerning debts owed by the 
customer. 


The Code also requires credit providers to give notification to 
borrowers at the time of application for credit of the choice to opt- 
out of the positive credit data reporting system in respect of closed 
account data. 


Clause 2.2A of the Code also recommends that credit providers 
should give a written reminder to the borrower within 30 days of the 
occurrence of a default by the borrower, that unless the amount in 
default is fully repaid or written off (otherwise than due to a 
bankruptcy order) before the expiry of 60 days from the date of the 
default, the individual shall be liable to have his account repayment 
data to be retained by the CRA until the expiry of 5 years from the 
date of final settlement of the amount in default or 5 years from the 
date of the individual's discharge from bankruptcy as notified to the 
CRA, whichever is earlier. 


Clause 2.3 of the Code also recommends that credit providers 
should give a written reminder to the borrower as soon as 
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6.5 


6.6 


practicable upon repayment in full of the credit facility, of his right to 
opt-out of the positive credit data reporting system. 


Als should ensure that sufficient prominence is given to such 
notifications. Also, Als should establish clear and comprehensive 
written procedures for making such notifications to their customers. 
These procedures should set out clearly when the notification 
should be made, the manner in which the notification is to be made 
and the type of information to be included in the notification. As 
required by the Code, Als should keep proper internal records of 
notifications of access for review for two years as evidence of 
compliance with the requirements of the Code. 


Als should take appropriate steps to ensure that the CRA is 
promptly notified of any “opt-out” requested by their former 
borrowers once the conditions for the opt-out are met by such 
borrowers. 


Access to Mortgage Count during the transitional period 


7.1 


Subject to certain exceptions, the Code provides that a credit 
provider shall not, during the transitional period, be entitled to 
access the mortgage count of an individual through a credit report, 
unless the access is made with the written consent of the individual 
and under any of the following circumstances: 


° considering an application for grant of a mortgage loan to 
the individual, or to another person for whom the individual 
proposes to act as mortgagor or guarantor; 


° reviewing existing credit facilities currently in material 
default with a view to putting in place a loan restructuring 
arrangement by the credit provider; 


° reviewing existing credit facilities, for the implementation of 
an existing loan restructuring arrangement between the 
individual and the credit provider (whether or not other 
parties are involved) by the credit provider; or 
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7.2 


7.3 


° reviewing existing credit facilities, with a view to putting in 
place a scheme of arrangement with the individual initiated 
by a request from the individual. 


The Code further provides that unless the review access is made in 
relation to an on-going debt restructuring arrangement that was in 
place at the time of the access or was customer initiated, credit 
providers should give prior notification to customers for all other 
debt restructuring related reviews conducted during the transitional 
period. 


Als should keep documentary evidence of compliance with the 
above requirements for a period of 2 years for compliance audit 
purposes. 


Engagement of CRA 


8.1 


8.2 


Als that use the service of a CRA should enter into a formal 
contractual agreement with the CRA that requires the CRA to have 
effective control systems to ensure compliance with all relevant 
requirements of the PDPO and the Code. Als should have effective 
procedures to monitor regularly the performance of the CRA, 
particularly in respect of its ability to comply with the requirements 
of the PDPO and the Code. 


An Al should consider whether to terminate its relationship with the 
CRA if it is aware of unacceptable practices of the CRA, or serious 
breaches of the requirements of the PDPO or the Code. The 
contract with the CRA should specify that account data (including 
the mortgage account general data) provided by the Al shall remain 
the property of the Al and that the Al has the right to remove its 
data on the termination of its contract with the CRA. 


Hong Kong Approach to Consumer Debt Difficulties 


9.1 


When the information obtained from the CRA reveals that a 
customer has incurred a level of indebtedness that may be 
unmanageable and the customer might have genuine difficulty in 
repaying the loans, Als should follow the guidelines set out in the 
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9.2 


9.3 


9.4 


“Hong Kong Approach to Consumer Debt Difficulties” to deal with 
such borrowers. 


Als should consider such cases sympathetically and discuss with 
the customer concerned to work out a solution that is mutually 
beneficial for both the customer and the Al concerned. In doing so, 
the customer should be made aware of the possibility of solving the 
problem by a Debt Relief Plan. 


Where the Al does not have a prior credit relationship with the 
individual who has applied for credit, the Al should suggest that the 
individual discuss the problem with the financial institution with 
which the individual has the major credit relationship as soon as 
possible. 


Als should not hastily demand immediate repayment of loans or 
reduce credit lines or actively recommend transfer of the balance. 
Instead, Als should follow the framework and procedures which are 
laid down in the Agreement on Debt Relief Plans, and the 
framework and procedures for Individual Voluntary Arrangements, 
and work out a mutually acceptable solution with the customer as 
far as possible. 
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